XKCD Forum Hacked – Over 562,000 Users’ Account Details Leaked

The security breach occurred two months ago, according to
security researcher Troy Hunt who alerted^[1] the company of the
incident, with unknown hackers stealing around 562,000 usernames,
email and IP addresses, as well as hashed passwords.

However, the leaked data was actually discovered by security
researcher and data analyst Adam Davies, who shared a copy of it
with Hunt.

At the time of writing, XKCD has taken down its forum and posted a short notice on its homepage,
as shared below, urging its users to change their passwords
immediately.

However, at this moment it’s unclear if XKCD was using an older
version of the forum software vulnerable to a security flaw or the
attackers exploited any previously undiscovered flaw in phpBB to
extract the data unauthorisedly.

Besides this, even if XKCD was running over phpBB version 3.1
and later, which uses more secure BCRYPT hashing algorithm, it’s
possible that the passwords for early users of the XKCD forum were
encrypted via the older, less secure MD5 hashing method.

What you can do now: affected users are strongly advised to
immediately change their XKCD password, as well as passwords for
any other online accounts which re-use the same password.

Created in 2005 by American author Randall Munroe, XKCD is a
popular webcomic that focuses on tech, science, and internet
culture, with its subject matter varies from statements on life and
love to mathematical, programming, and scientific in-jokes.

^[2]